Skip to main content

LeapPad Kids Tablet Found To Have Security Issues

By August 21, 2019May 16th, 2022Cybersecurity

Researchers at CheckMarx recently discovered some serious security flaws in the popular LeapPad Ultimate tablet.

The tablet was designed by LeapFrog to provide kids in the UK and Europe with a safe environment to access games, videos and educational apps.

The researchers had this to say about their discovery:

“The first thing we found is that some of LeapFrog’s communications aren’t encrypted.  It’s using very simple HTTP protocol, storing information in clear text and allowing an attacker to become a man-in-the-middle.”

The researchers built a proof of concept app that allowed them to spoof the existing connection and force the device onto a rogue network.  From there, they were able to inject malicious scripts into the rogue network and use them to access a variety of sensitive information from the system, such as the child’s name, gender, birth year and birth month.

The researchers also noted that this attack methodology could allow hackers to steal information about the parents of the kids using the device, including their email addresses, phone numbers and access to payment card information.

Mari Sunderland, the VP of Digital Product Management at LeapFrog, issued a formal statement for the company, which read, in part, as follows:

“We thank CheckMarx for bringing these security issues to our attention, as the safety of the children who use our products is our top priority. When you know that the main users of your device will be children, the standards you need to put on your R&D need to be the highest:  Military grade.  Vendors should be very responsible and understand that privacy issues for children are much worse.  All this needs to be taken into account to make sure your solution is as safe as possible.”

It’s a wonderful sentiment, and one hopes that LeapFrog’s next solution will be more robust.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.